More flexible CORS support in core, to encourage good security practices
See original GitHub issueIt would be nice if the --cors
option accepted an origin regex to more securely allow secure local development.
As an example, Observable notebooks namespace every user’s notebooks by their username and user content is served from username.observableusercontent.com, so you would set --cors-origin username.observableusercontent.com
to restrict access to a local development Datasette instance to only your own notebooks, rather than exposing the data to any website that makes a request.
Thank you for all of your work on Datasette!
Issue Analytics
- State:
- Created 3 years ago
- Comments:6 (5 by maintainers)
Top Results From Across the Web
How to Avoid CORS Security Issues in 2021 | Cross-Origin ...
We have recently identified critical cross-origin resource sharing (CORS) vulnerabilities for a number of clients. Here are the key mistakes ...
Read more >Enable Cross-Origin Requests (CORS) in ASP.NET Core
This article shows how to enable CORS in an ASP.NET Core app. Browser security prevents a web page from making requests to a...
Read more >Chapter 6. Best practices - CORS in Action - liveBook · Manning
The goal of this chapter is to build a flexible CORS server that can be used with a variety of configurations. To do...
Read more >Secretary-General's Initiative on Action for Peacekeeping
A4P: Our core agenda for Peacekeeping ... Member States are encouraged to support A4P by focusing on their ... Read more about women,...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
I think the right way to do this is to support multiple optional
--cors-origin=
pattern values, like you suggested.This may involve a breaking change to the CLI settings interface, so I’m adding this to the 1.0 milestone.